February 2021 - openstack-discuss

[cinder/barbican] LUKS encryption for mounted disk - how to decrypt cinder volume
by Jan Wasilewski 23 Feb '21

23 Feb '21

Hi All, I have a question about the possible decryption of LUKS volume. I'm testing currently barbican+cinder, but I'm just wondering if there is a way, to somehow decrypt my LUKS volume with payload generated by a barbican. Is there any procedure for that? I was doing it by myself, but somehow it doesn't work and I got an error: [TEST]root@barbican-01:/usr/lib/python3/dist-packages# barbican secret get --payload --payload_content_type application/octet-stream http://controller.test:9311/v1/secrets/76631940-9ab6-4b8c-9481-e54c3ffdbbfe +---------+--------------------------------------------------------------------------------------------------------+ | Field | Value | +---------+--------------------------------------------------------------------------------------------------------+ | Payload | b'\xbf!i\x97\xf4\x0c\x12\xa4\xfe4\xf3\x16C\xe8@\xdc\x0f\x9d+:\x0c7\xa9\xab[\x8d\xf2\xf1\xae\r\x89\xdc' | +---------+--------------------------------------------------------------------------------------------------------+ cryptsetup luksOpen /dev/disk/by-id/wwn-0x6e00084100ee7e7e7ab0b13c0000386f my-volume Enter passphrase for /dev/disk/by-id/wwn-0x6e00084100ee7e7e7ab0b13c0000386f: *<passphrase from payload>* No key available with this passphrase. I thought that above issue can be related to encoding, so I took payload value directly from vault and use it as a key-file, but problem is exactly the same(my encrypted volume is the last volume list by domblklist option): vault kv get secret/data/e5baa518207e4f9db4810988d22087ce | grep value | awk -F'value:' '{print $2}' 4d4d35676c336567714850663477336d2b415475746b74774c56376b77324b4e73773879724c46704678513d] [TEST]root@comp-02:~# cat bbb 4d4d35676c336567714850663477336d2b415475746b74774c56376b77324b4e73773879724c46704678513d [TEST]root@comp-02:~# cat bbb | base64 -d > pass2 [TEST]root@comp-02:~# cat pass2 ▒▒߻▒▒▒▒▒^<▒N▒▒▒▒~پ5▒▒▒▒▒▒▒z߾▒▒▒▒~▒▒▒▒▒n▒▒▒▒▒]▒[TEST]root@comp-02:~# [TEST]root@comp-02:~# virsh domblklist instance-00000da8 Target Source ------------------------------------------------ vda /dev/dm-17 vdb /dev/disk/by-id/wwn-0x6e00084100ee7e7e74623bd3000036bc vdc /dev/dm-16 vde /dev/disk/by-id/wwn-0x6e00084100ee7e7e7ab0b13c0000386f vdf /dev/disk/by-id/wwn-0x6e00084100ee7e7e7bd45c1b000038b5 [TEST]root@comp-02:~# udisksctl unlock -b /dev/disk/by-id/wwn-0x6e00084100ee7e7e7bd45c1b000038b5 --key-file pass2 Error unlocking /dev/dm-21: GDBus.Error:org.freedesktop.UDisks2.Error.Failed: Error unlocking /dev/dm-21: Failed to activate device: Operation not permitted [TEST]root@comp-02:~# cryptsetup luksOpen /dev/disk/by-id/wwn-0x6e00084100ee7e7e7bd45c1b000038b5 my-volume --master-key-file=pass2 Volume key does not match the volume. I see that nova/cinder and barbican are doing this stuff somehow so I strongly believe there is a way to decrypt this manually. Maybe I’m doing something wrong in my testing-steps. Thanks in advance for any help here! Unfortunately, I haven’t found any materials on how to do this. Best regards, Jan

2 5

[tc] weekly update
by Mohammed Naser 22 Feb '21

22 Feb '21

Hi everyone, Here's an update on what happened in the OpenStack TC this week. You can get more information by checking for changes in openstack/governance repository. # Patches ## Open Reviews - Cool-down cycle goal https://review.opendev.org/c/openstack/governance/+/770616 - monasca-log-api & monasca-ceilometer does not make releases https://review.opendev.org/c/openstack/governance/+/771785 ## Project Updates - Retire tempest-horizon https://review.opendev.org/c/openstack/governance/+/774379 ## General Changes - Add assert:supports-api-interoperability tag to neutron https://review.opendev.org/c/openstack/governance/+/773090 - Add assert:supports-api-interoperability to cinder https://review.opendev.org/c/openstack/governance/+/773684 # Other Reminders - Our next [TC] Weekly meeting is scheduled for February 25th at 1500 UTC. If you would like to add topics for discussion, please go to https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting and fill out your suggestions by Wednesday, February 24th, 2100 UTC. Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0

[edge][all] Features and updates relevant to edge computing use cases
by Ildiko Vancsa 22 Feb '21

22 Feb '21

Hi, I’m reaching out as I need a little guidance. I was asked to give a presentation about the latest features and improvements in OpenStack that are relevant for edge computing. I wanted to ask for the community’s help, as the project teams are the experts, to give any pointers that you think would be great to include in my presentation. I appreciate all your guidance in advance. Thanks, Ildikó

2 2

Non-DHCP VLAN Network ARP Problem with OVN
by Lazuardi Nasution 22 Feb '21

22 Feb '21

Hi, One of our OpenStack clusters has a VLAN based network without DHCP enabled. The cluster uses OVN for SDN.That network has to be like it since it will be used for migrating the VMs from other platforms. I have untick the DHCP enable feature on creating that network at Horizon. After the network and subnet are created, I find that the DHCP port is still created even though it is in a down state. I try to delete that port but after some time, that port is back again. When that DHCP port exists, we find that some VMs inside this OpenStack cluster resolve the MAC address of the IP of that disabled DHCP port to the MAC address of the DHCP port. The problem is coming since that IP is used to an existing VM/server outside this OpenStack cluster at the same VLAN, but it only happens for some VMs. Before this finding, I really disregard the existence of the DHCP port since it is down and I don't enable the DHCP feature. After that, I realize that it is a serious problem. My questions are how to completely disable the DHCP feature for such a network, including its DHCP port? How can DHCP disabled networks with a down DHCP port still respond to the ARP request and why does it happen only for some VMs? Best regards,

3 6

OVN Distributed Floating IP and L3 Gateway HA
by Lazuardi Nasution 22 Feb '21

22 Feb '21

Hi, For having OVN distributed floating IP, should I use the "distributed" flag on router creation of OpenStack and/or use all compute nodes as Gateway Chassis? For having L3 Gateway HA for non floating IP instances, should I use the "ha" flag on router creation of OpenStack? I ask this since I find that pinging from outside network to floating IP always comes to one of Gateway Chassis nodes. Is this normal behavior? Best regards.

1 0

[Murano] error in murano-dashboard when clicking on add component in environment
by Bujack, Stefan 22 Feb '21

22 Feb '21

Hello, we have an openstack victoria deployment on ubuntu 20.04. We use the murano-dashboard in horizon. When clicking on add component in APP Catalog --> Applications --> Environments we get an error page and apache2 has an error: ==> /var/log/apache2/error.log <== [Thu Feb 18 14:17:51.223960 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] /usr/lib/python3/dist-packages/django/contrib/staticfiles/templatetags/staticfiles.py:24: RemovedInDjango30Warning: {% load staticfiles %} is deprecated in favor of {% load static %}. [Thu Feb 18 14:17:51.224014 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] warnings.warn( [Thu Feb 18 14:17:51.226557 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] ERROR django.request Internal Server Error: /app-catalog/catalog/switch_environment/281f558410fb40bf8f5e090f04d90248 [Thu Feb 18 14:17:51.226584 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] Traceback (most recent call last): [Thu Feb 18 14:17:51.226590 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/django/core/handlers/exception.py", line 34, in inner [Thu Feb 18 14:17:51.226594 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] response = get_response(request) [Thu Feb 18 14:17:51.226598 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/django/core/handlers/base.py", line 115, in _get_response [Thu Feb 18 14:17:51.226602 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] response = self.process_exception_by_middleware(e, request) [Thu Feb 18 14:17:51.226606 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/django/core/handlers/base.py", line 113, in _get_response [Thu Feb 18 14:17:51.226610 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] response = wrapped_callback(request, *callback_args, **callback_kwargs) [Thu Feb 18 14:17:51.226615 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/horizon/decorators.py", line 52, in dec [Thu Feb 18 14:17:51.226619 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] return view_func(request, *args, **kwargs) [Thu Feb 18 14:17:51.226622 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/horizon/decorators.py", line 36, in dec [Thu Feb 18 14:17:51.226626 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] return view_func(request, *args, **kwargs) [Thu Feb 18 14:17:51.226630 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/horizon/decorators.py", line 36, in dec [Thu Feb 18 14:17:51.226634 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] return view_func(request, *args, **kwargs) [Thu Feb 18 14:17:51.226637 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/horizon/decorators.py", line 113, in dec [Thu Feb 18 14:17:51.226641 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] return view_func(request, *args, **kwargs) [Thu Feb 18 14:17:51.226656 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/django/contrib/auth/decorators.py", line 21, in _wrapped_view [Thu Feb 18 14:17:51.226660 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] return view_func(request, *args, **kwargs) [Thu Feb 18 14:17:51.226665 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] File "/usr/lib/python3/dist-packages/muranodashboard/catalog/views.py", line 129, in switch [Thu Feb 18 14:17:51.226671 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] if not http_utils.is_safe_url(url=redirect_to, host=request.get_host()): [Thu Feb 18 14:17:51.226674 2021] [wsgi:error] [pid 3970511:tid 139721480873728] [remote 131.169.5.116:43998] TypeError: is_safe_url() got an unexpected keyword argument 'host' Any help is appreciated Thanks in advance Greets Stefan Bujack

2 2

[neutron] Bug Deputy Report Feb 15 - 21
by Oleg Bondarev 22 Feb '21

22 Feb '21

Hello all interested, Please check Neutron new bugs summary for the week Feb 15-21 I'd like to highlight 2 gate blockers looking for an assignees: - 1916332<https://bugs.launchpad.net/neutron/+bug/1916332> - broken openstack-tox-docs job on neutron-specs - 1916041<https://bugs.launchpad.net/neutron/+bug/1916041> - tempest-slow-py3 job fails on stable/stein There is also a medium one 1916276<https://bugs.launchpad.net/neutron/+bug/1916276> that seeks for volunteers. And a discussoin topic for the team: 1916428<https://bugs.launchpad.net/neutron/+bug/1916428> regarding dibbler tool end of support. Full report: Critical * https://bugs.launchpad.net/neutron/+bug/1915692 - Neutron tempest plugin jobs for stable/stein are broken as they are using tempest from master branch o Fix Released o Assigned to Slawek Kaplonski * https://bugs.launchpad.net/neutron/+bug/1916332 - neutron-specs's zuul job openstack-tox-docs fails o Confirmed o Unassigned * https://bugs.launchpad.net/neutron/+bug/1916041 - tempest-slow-py3 ipv6 gate job fails on stable/stein o Confirmed o Unassigned High * https://bugs.launchpad.net/neutron/+bug/1916024 - HA router master instance in error state because qg-xx interface is down o In Progress o Assigned to Rodolfo Alonso Hernandez Medium * https://bugs.launchpad.net/neutron/+bug/1915723 - [OVN] QoS rules do not apply to distributed floating IP traffic o In Progress o Assigned to Rodolfo Alonso Hernandez * https://bugs.launchpad.net/neutron/+bug/1915849 - setting a bound port qos policy from empty to a policy with min bw rules does not update placement allocation o Confirmed o Assigned to Lajos Katona * https://bugs.launchpad.net/neutron/+bug/1915856 - updating a qos policy on a bound port from None to a policy with min_bw rules does not update placement allocation o Confirmed o Assigned to Lajos Katona * https://bugs.launchpad.net/neutron/+bug/1915898 - changing the qos policy on a network does not change the placement allocation of the bound ports in the network o Confirmed o Assigned to Lajos Katona * https://bugs.launchpad.net/neutron/+bug/1916276 - IP address inventory handling for routed net does not work for ip_allocation=deferred o Confirmed o Unassigned Low * https://bugs.launchpad.net/neutron/+bug/1916022 - L3HA Race condition during startup of the agent may cause inconsistent router's states o In Progress o Assigned to Slawek Kaplonski Opinion (Undecided) * https://bugs.launchpad.net/neutron/+bug/1916428 - dibbler tool for dhcpv6 is concluded o Needs discussion Thanks, Oleg --- Advanced Software Technology Lab Huawei

1 0

[Outreachy] Call for mentors, projects by March 7
by Samuel de Medeiros Queiroz 20 Feb '21

20 Feb '21

Hi Stackers, *TL;DR OpenStack is participating in Outreachy!* *Please submit projects as soon as possible, deadline is March 7th, 4 pm UTC:* *https://www.outreachy.org/communities/cfp/openstack/ <https://www.outreachy.org/communities/cfp/openstack/>* Outreachy's goal is to support people from groups underrepresented in the technology industry. Interns will work remotely with mentors from our community. We are seeking mentors to propose projects that Outreachy interns can work on during their internship. If you or your colleagues are interested in mentoring in the next round, please submit your project proposal by *March 7th 2021 *over here https://www.outreachy.org/communities/cfp/openstack/ Mentors should read the mentor FAQ https://www.outreachy.org/mentor/mentor-faq and find more details about the Outreachy program and timeline in https://www.outreachy.org/communities/cfp/ . If you want help crafting your project proposal, please contact me < samueldmq(a)gmail.com> or Mahati Chamarthy <mahati.chamarthy(a)gmail.com> and we will be glad to assist you. Thank you, Samuel Queiroz

1 0

[cinder] os-brick nvmeof connector changes
by Brian Rosmaita 20 Feb '21

20 Feb '21

The nvmeof connector was refactored by Change-Id: I84145ce0be96c3e39b00720bddd179f91703b978 [0] that is included in os-brick release 4.2.0. Unfortunately, it introduced a regression that has broken current drivers consuming that connector [1]. Ivan has a patch up to revert the change and restore the legacy nvmeof connector [2]. Zohar suggests instead adding some compatibility code to the refactored driver. Please take a look at [2] and leave some helpful responses. The Mellanox CI, which runs the SPDK driver that uses the nvmeof connector hasn't been responding recently, but Ivan said he can trigger it manually to test changes, so we'll be able to validate the "old" nvmeof connector interface. [0] https://review.opendev.org/c/openstack/os-brick/+/768575 [1] https://bugs.launchpad.net/os-brick/+bug/1916264 [2] https://review.opendev.org/c/openstack/os-brick/+/776441

1 0

[ops][cinder] warning about os-brick release 4.2.0
by Brian Rosmaita 20 Feb '21

20 Feb '21

This message applies to operators using cinder drivers that use the os-brick nvmeof connector. os-brick release 4.2.0, released on 16 February, contains a refactored nvmeof connector that unfortunately introduced a regression in the connector interface and breaks older drivers that use the nvmeof connector. So if you use such a driver, do not upgrade to 4.2.0. This issue will be resolved before the "official" wallaby os-brick release. You can follow events as they unfold on Bug #1916264: https://bugs.launchpad.net/os-brick/+bug/1916264

1 0